Bug 132725 - ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)
Summary: ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObjec...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Bem Jones-Bey
URL: http://en.wikipedia.org/wiki/Outline_...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-05-08 19:24 PDT by Simon Fraser (smfr)
Modified: 2014-10-28 09:33 PDT (History)
3 users (show)

See Also:


Attachments
Pared down wikipedia page + css (24.34 KB, application/x-gzip)
2014-10-28 09:33 PDT, cand
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Simon Fraser (smfr) 2014-05-08 19:24:28 PDT
Seen on http://en.wikipedia.org/wiki/Outline_of_Equatorial_Guinea in the iPad sim (but probably reproduces on desktop too?)

ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)
/Volumes/Data/Development/OSX/webkit/OpenSource/Source/WebCore/rendering/FloatingObjects.cpp(464) : void WebCore::ComputeFloatOffsetAdapter<2>::collectIfNeeded(const IntervalType &) [FloatTypeValue = 2]
1   0x111644d10 WTFCrash
2   0x107416895 WebCore::ComputeFloatOffsetAdapter<(WebCore::FloatingObject::Type)2>::collectIfNeeded(WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*> const&)
3   0x10741665e void WebCore::PODIntervalTree<WebCore::LayoutUnit, WebCore::FloatingObject*>::searchForOverlapsFrom<WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2> >(WebCore::PODRedBlackTree<WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*> >::Node*, WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2>&) const
4   0x1074166ab void WebCore::PODIntervalTree<WebCore::LayoutUnit, WebCore::FloatingObject*>::searchForOverlapsFrom<WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2> >(WebCore::PODRedBlackTree<WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*> >::Node*, WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2>&) const
5   0x107416580 void WebCore::PODIntervalTree<WebCore::LayoutUnit, WebCore::FloatingObject*>::allOverlapsWithAdapter<WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2> >(WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2>&) const
6   0x107415032 WebCore::FloatingObjects::logicalRightOffset(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit)
7   0x1084f29e9 WebCore::RenderBlockFlow::logicalRightFloatOffsetForLine(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit) const
8   0x10823cfad WebCore::RenderBlock::logicalRightOffsetForLine(WebCore::LayoutUnit, WebCore::LayoutUnit, bool, WebCore::LayoutUnit) const
9   0x10823ce6f WebCore::RenderBlock::logicalRightOffsetForLine(WebCore::LayoutUnit, bool, WebCore::LayoutUnit) const
10  0x108870551 WebCore::RootInlineBox::selectionTop() const
11  0x108677f18 WebCore::RenderLineBoxList::lineIntersectsDirtyRect(WebCore::RenderBoxModelObject*, WebCore::InlineFlowBox*, WebCore::PaintInfo const&, WebCore::LayoutPoint const&) const
12  0x108678b58 WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, WebCore::PaintInfo&, WebCore::LayoutPoint const&) const
13  0x1084f6456 WebCore::RenderBlockFlow::paintInlineChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
14  0x1084acecc WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
15  0x1084adb93 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
16  0x1084acd0b WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
17  0x1084ad410 WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
18  0x1084ad047 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
19  0x1084acfce WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
20  0x1084adb93 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
21  0x1084acd0b WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
22  0x1084ad410 WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
23  0x1084ad047 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
24  0x1084acfce WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
25  0x1084adb93 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
26  0x1084acd0b WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
27  0x10861bc15 WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*)
28  0x108619a58 WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, WebCore::GraphicsContext*, WebCore::LayoutRect const&, bool, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*, bool, bool)
29  0x108615453 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
30  0x108614a2a WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
Comment 1 Bem Jones-Bey 2014-05-12 21:50:12 PDT
I am not able to repro this on my local (desktop) build. Do you have any other examples that show the issue?
Comment 2 Bem Jones-Bey 2014-05-19 14:34:11 PDT
Is this still a problem? Are there any other pages that show the issue?
Comment 3 Bem Jones-Bey 2014-08-19 14:11:14 PDT
I've never been able to repro this myself. Is this still an issue, or should I close it?
Comment 4 cand 2014-10-25 11:10:23 PDT
I'm hitting this too, though on my FLTK port, and not the original URL. My port is based on r169702, and the following wikipedia url repeatedly hits the same assert as the original reporter's:

en.wikipedia.org/wiki/Katawa_Shoujo

The calltrace is slightly different, though mine is from valgrind:

ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)
rendering/FloatingObjects.cpp(464) : void WebCore::ComputeFloatOffsetAdapter<FloatTypeValue>::collectIfNeeded(const IntervalType&) [with WebCore::FloatingObject::Type FloatTypeValue = (WebCore::FloatingObject::Type)2u; WebCore::ComputeFloatOffsetAdapter<FloatTypeValue>::IntervalType = WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*>]
    by 0x177E8E6: WebCore::FloatingObjects::logicalRightOffset(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit) 
    by 0x172D3A1: WebCore::RenderBlockFlow::logicalRightFloatOffsetForLine(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit) const 
    by 0x1732B70: WebCore::RenderBlockFlow::getClearDelta(WebCore::RenderBox&, WebCore::LayoutUnit) 
    by 0x1734C0A: WebCore::RenderBlockFlow::clearFloatsIfNeeded(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit) 
    by 0x173893A: WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 
    by 0x173904C: WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 
    by 0x173B60E: WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
Comment 5 cand 2014-10-28 08:55:00 PDT
The values of the failing range are:

rangesintersect 6605.453125 6719.453125 (422749 430045) - 6577.062500 6605.062500 (420932 422724) bool 0

float float raw raw, same order as in the assert. They clearly don't overlap, and that's too big to be a rounding error.
Comment 6 cand 2014-10-28 09:33:01 PDT
Created attachment 240548 [details]
Pared down wikipedia page + css

Attaching a pared down wikipedia page and css. This still causes the bug for me.

Note as the bug depends on the resolution, you may need to set your webkit widget to exactly 800x600 to reproduce.